An intelligent method for verifying vulnerability scanning of power information system

Abstract

The present application relates to a kind of electric power information system vulnerability scanning verification intelligent method.The present application is formed by the key technologies such as electric power information network Web system asset identification and vulnerability intelligent detection, and forms the intelligent, non-destructive electric power information network Web system asset identification and vulnerability intelligent detection technology system, comprehensively improves the deep level vulnerability mining of electric power information network Web system and the accurate identification ability of attack, makes the supplement for the research of company network security field in scientific research, technology and equipment etc.Aspects of research.From the angle of attack research, it will promote the research and development of related security technology and product in the field of electric power.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an intelligent method for vulnerability scanning and verification of power information systems. Background Technology

[0002] The inherent vulnerabilities in the power industry's web-based business systems pose a risk of network and information security risks being transmitted to the power system. Domestic and international research on backdoors, vulnerabilities, and weaknesses in power industry business systems is increasingly focused on and in-depth. Security vulnerability information and attack code for some power industry business system products are spreading on the internet, gradually lowering the barrier to attacking the network security of power industry business systems, making the network security situation of power information systems increasingly severe. According to statistics, the State Grid Corporation of China currently has more than 2,700 web-based business systems, connected to more than 540 million terminals such as smart meters, with a daily data increase exceeding 60TB. The sheer scale of the system makes manual vulnerability investigation insufficient in terms of timeliness and accuracy.

[0003] The main reasons for these issues are: 1) Low vulnerability detection / handling rate in the power system; 2) Insufficient manual vulnerability security patrols and supervision to address the massive number of web systems, resulting in a large number of unaddressed vulnerabilities; 3) High false positive / false negative rates in existing traditional vulnerability scanning products; 4) Lack of vulnerability verification capabilities due to version matching for vulnerability identification, leading to extremely high false positive rates; 5) Inconsistent personnel skill levels and difficulty in solidifying best practices; 6) The effectiveness of manual vulnerability discovery is closely related to the professional competence of personnel, and the work of a few highly skilled individuals cannot be replaced by multiple average personnel; 7) Vulnerability discovery skills are individualized, and with personnel turnover, it is difficult to solidify best practices. Therefore, utilizing artificial intelligence technology to learn from excellent manual vulnerability penetration testing experience and solidify it into models can improve vulnerability discovery levels and efficiency, reduce the probability of power information network web systems operating with vulnerabilities, and enhance the security and robustness of the company's business systems. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent method for vulnerability scanning and verification in power information systems, forming an intelligent and non-destructive technology system for asset identification and vulnerability detection in power information network Web systems, and comprehensively improving the ability to discover deep-level vulnerabilities and accurately identify attacks in power information network Web systems.

[0005] To achieve the above objectives, the technical solution of the present invention is: an intelligent method for vulnerability scanning and verification in a power information system, comprising:

[0006] S1. Construct a machine learning-based web system vulnerability identification model;

[0007] S2. Intelligent vulnerability verification: Intelligent vulnerability verification is achieved by combining a target machine-based intelligent vulnerability exploitation verification mode and a human experience tree-based intelligent vulnerability exploitation verification mode.

[0008] S3, automatic extraction of Web vulnerability penetration test payloads;

[0009] S4. Knowledge graph-based web vulnerability penetration testing;

[0010] S5. Use recurrent neural networks to guide web vulnerability penetration testing.

[0011] In one embodiment of the present invention, step S1, the machine learning-based Web system vulnerability identification model, has two stages: a learning stage and an identification stage. In the learning stage, a series of vulnerabilities are collected from a vulnerability database as input, and the output of the learning stage is an automated vulnerability identification model. In the identification stage, the target vulnerability is input, and then its features are extracted and corresponding feature vectors are generated. The automated vulnerability identification model classifies and identifies the type of the target vulnerability, and finally outputs a report of the identified vulnerabilities. Specifically, the learning stage includes:

[0012] Step 1) Extract the vulnerability features to be trained. Vulnerability features are multiple quantifiable vulnerability characteristics that can be used to distinguish the types of vulnerabilities, including meta-features, text features, and code features.

[0013] Step 2) Generation of vulnerability feature vectors to be trained: The multiple vulnerability features extracted in Step 1) are used to generate the feature vector of each vulnerability. Each feature vector has a corresponding label indicating the type of vulnerability.

[0014] Step 3) Automated identification model construction: Based on the labeled vulnerability feature vectors in the training set, construct and train an automated vulnerability identification model;

[0015] The identification phase includes:

[0016] Step 4) Target vulnerability feature extraction: Extract three types of features from the target vulnerability, namely meta-features, text features, and code features;

[0017] Step 5) Target vulnerability feature vector generation: The target vulnerability features extracted in step 4) are converted into vector representations.

[0018] Step 6) Automated vulnerability identification: Based on the test set, the automated vulnerability identification model trained during the learning phase identifies the feature vector type corresponding to the vulnerability. When the feature vector is identified as "1", it means that the corresponding vulnerability is an identified vulnerability, and a vulnerability report is output.

[0019] In one embodiment of the present invention, the specific method for code feature extraction in step 1) or step 4) is as follows:

[0020] ① Download the corresponding patch file for the vulnerability by analyzing the Attachment field of the vulnerability's attachment. A patch consists of a diff header and a diff segment. The diff header provides a basic description of the patch information, while the diff segment shows the code changes in the patch; ② Calculate the number of lines of code added or deleted in a vulnerability patch based on the prefix symbols "-" and "+", and calculate the number of files modified in the vulnerability patch based on the prefix symbol "+++"; ③ Scan the code with added or deleted lines to check for dangerous functions or externally input functions; dangerous functions refer to library functions or API functions that are prone to security issues, while externally input functions refer to library functions or API functions that directly receive one or more external inputs; ④ Calculate the vulnerability remediation complexity.

[0021] In one embodiment of the present invention, the specific method for generating the feature vector in step 1) or step 4) is as follows:

[0022] Feature vectors describe vulnerability reports in three dimensions: meta-features, text features, and code features; for each dimension, a series of characteristics are extracted. Therefore, the feature vector of a vulnerability is represented as:

[0023] V report ={v meta ,v text ,v code} (1)

[0024] Among them, meta is transformed from a set of meta-features, tet is transformed from a set of text features, and code is transformed from a set of code features;

[0025] For the meta-features, after numerical mapping and normalization, they are finally converted into meta-feature vectors, represented as:

[0026] v meta ={V m1 V m2 , ...,V m6} (2)

[0027] Among them, V m1 V corresponds to the time the vulnerability was submitted. m2 Indicates the severity of the vulnerability, with values ​​ranging from 0 to 6, corresponding to 6 different severity labels. "0" indicates that the corresponding severity field is empty. m3 This indicates the vulnerability priority, with values ​​ranging from 0 to 5, corresponding to 5 different priority tags. "0" indicates that the corresponding priority field is empty. mi(4≤i≤6) correspond to the other fields in the dangerous function and the external input function, respectively;

[0028] For text features, the focus is on the Summary field, which is a sentence summarizing the vulnerability. This sentence is analyzed using natural language processing techniques and ultimately converted into sentence vectors, which serve as text feature vectors. This process involves the following three steps:

[0029] ① Tokenization is a process that uses lexical analysis to split a sentence into a set of tokens based on delimiters. During the segmentation process, the tokens should also be converted to lowercase letters and special characters should be removed.

[0030] ② Stop words removal: Remove stop words from the tokens set generated in the previous step;

[0031] ③ Vector generation: After stopping word deletion, a large number of meaningful tokens are obtained. In order to map these tokens into vectors, the word2vec tool library is used to convert a token into a fixed-dimensional vector, i.e., word embedding. Finally, the word vectors corresponding to all the tokens that make up the sentence are accumulated to obtain the sentence vector, i.e., as shown in formula (3). Since word vectors can be trained to different fixed dimensions, the corresponding sentence vectors also have different dimensions n.

[0032]

[0033] For code features, the attachment fields of the vulnerability list are extracted. After parsing the patch files, the corresponding code feature vectors are calculated and generated, as follows:

[0034]

[0035] Among them, v c1 v c2 A value of "1" indicates that at least one dangerous function or externally input function exists in the vulnerability patch file; otherwise, a value of "0" is assigned. c3 The number of lines of code added or removed in the corresponding vulnerability patch, v c4 The number of files involved in the corresponding vulnerability patch, v c5 The complexity of the corresponding vulnerability patch.

[0036] In one embodiment of the present invention, the method for constructing the automated vulnerability identification model in step 1) is as follows:

[0037] After generating feature vectors, a support vector machine (SVM) is used to build an automated vulnerability identification model. The radial basis function (RBF) is selected as the kernel function. To solve the optimization problem of SVM, the parameters c and g are determined, corresponding to the loss function and gamma function, respectively. Based on the training set, i.e. the labeled feature vectors, 10-fold cross-validation and grid search are used to select the globally optimal combination of parameters c and g. Finally, an automated vulnerability identification model with precisely adjusted model parameters is constructed.

[0038] The target is traversed to obtain all test paths from the initial state to the target state. During the traversal of the automated vulnerability identification model, all types of vulnerability threats will be extracted, the initial state and detection result state will be confirmed respectively, and their respective sub-state transition graphs will be created to form the global state. Finally, a comprehensive judgment will be made through automated vulnerability identification, and the detection results of the automated vulnerability identification model will be output.

[0039] In one embodiment of the present invention, step S3 is specifically implemented as follows:

[0040] S31. Based on TF-IDF, feature vectors are generated for Web log data samples from different paths, and the feature vectors are aggregated according to the parameter dimension.

[0041] S32. Extract the anomaly score AS of the sample parameter among other parameter values ​​of the same parameter Key in the same path based on the feature vector;

[0042] S33. Set a threshold T, and take out the abnormal parameter values ​​where AS is greater than T as the output;

[0043] S34. Automatic extraction of payload for Web vulnerability penetration testing based on abnormal parameter values.

[0044] In one embodiment of the present invention, in step S4, the knowledge graph is a network security knowledge graph comprising five dimensions: basic dimension, vulnerability dimension, threat dimension, alarm event dimension, and attack rule dimension. Its construction method is as follows: collecting knowledge information from the five dimensions, including CVE vulnerability knowledge, CAPEC attack classification identification, CWE host software knowledge, Snort alarm event knowledge, and attack rule expert knowledge; extracting entity attribute information by writing an XML processing program and regular expressions; using the graph database Neo4j as the knowledge graph construction tool, and inserting the corresponding knowledge information into the knowledge graph by writing Cypher statements.

[0045] In one embodiment of the present invention, step S5 is specifically implemented as follows:

[0046] Step S51: Divide the manual vulnerability penetration testing experience. The manual vulnerability penetration testing experience describes a complete vulnerability penetration testing process. According to the use of different vulnerability penetration testing methods, the manual vulnerability penetration testing experience is divided into multiple segments, including: Segment 1: Obtaining target environment information and finding the user login window; Segment 2: Login window + further obtaining target environment information and obtaining login password; Segment 3: Login password + further obtaining target environment information and reading sensitive data.

[0047] Step S52: Convert the associated data samples established in step (1) into a data format that can be input into the LSTM neural network through one-hot encoding;

[0048] Step S53: Preprocess the input data: After one-hot encoding of the target environment information, the length of the converted data may not be equal due to the differences in the target environment information recorded in different experiences. For the convenience of subsequent input into the LSTM neural network, the data dimension is uniformly specified as 128 bits. For data with insufficient length, 0 bits are used, and for data with excessive length, a hash function is used to reduce the dimension.

[0049] Step S54: Constructing an LSTM neural network: Based on the segments obtained in step S51, it can be seen that there is a correlation between the segments. The output of the previous segment can be used as part of the input of the next segment. Therefore, in the input of the LSTM neural network, the time step is set to 2. The input data of a segment has 128 dimensions. Therefore, the input layer of the LSTM is designed with 128 input parameters, including 2 hidden layers, each with 2 cells. The output layer also has 128 parameters. A linear fully connected layer is added after the output layer, taking the 128 parameters as input and setting the output parameters to 24.

[0050] Step S55: Train the parameters in the LSTM neural network;

[0051] Step S56: Use the trained LSTM neural network to guide vulnerability penetration verification. Obtain information about the target system through asset scanning and identification. Use steps S51-S53 to preprocess the obtained target environment information. Input the processed 128-bit data into the trained LSTM neural network. Based on the output 24-bit data, select the corresponding penetration verification method to verify the vulnerability.

[0052] In one embodiment of the present invention, the target environment information includes: system type, system version, service type, service version, middleware type, middleware version, development language, and data response package content; the vulnerability penetration methods include: information disclosure vulnerabilities, command execution vulnerabilities, arbitrary file reading vulnerabilities, IIS middleware vulnerabilities, Weblogic middleware vulnerabilities, NGINX middleware vulnerability intelligent exploitation module, PHP vulnerability intelligent exploitation module, Tomcat middleware vulnerability intelligent exploitation module, JBOSS middleware vulnerability intelligent exploitation module, SQL injection vulnerabilities, management entry vulnerabilities, Form framework vulnerability intelligent exploitation module, editor vulnerabilities, XSS vulnerabilities, file upload vulnerabilities, command injection vulnerabilities, XML external entity vulnerabilities, arbitrary file download vulnerabilities, directory traversal vulnerabilities, file inclusion vulnerabilities, CMS vulnerabilities, common service vulnerabilities, and hardware and system vulnerabilities; the descriptions in fragments 1, 2, and 3 are categorized to establish a data sample linking target environment information and vulnerability penetration methods.

[0053] Compared with existing technologies, the present invention has the following beneficial effects: The present invention provides an intelligent method for vulnerability scanning and verification in power information systems, which can form an intelligent and non-destructive technology system for asset identification and vulnerability detection in power information network Web systems. This comprehensively improves the ability to discover deep-level vulnerabilities and accurately identify attacks in power information network Web systems, supplements the company's research in the fields of network security, technology and equipment, enhances the enterprise's security controllability, promotes the large-scale application of network and information security protection solutions in various industries, and has significant demonstrative significance for promoting the development of national information security. Attached Figure Description

[0054] Figure 1 This is an architecture diagram of a machine learning-based web system vulnerability identification model. Figure 2 This is the patch file corresponding to Bug 1292443. Figure 3 This is a diagram illustrating the traversal of the test path. Figure 4 This is a schematic diagram of the model principle. Figure 5 This is the ROC space curve. Figure 6 The space curves are for different AUC values. Figure 7 A new intelligent model for vulnerability scanning and verification in power information systems. Figure 8 The results are for validating the random forest model. Figure 9 A framework for constructing a cybersecurity knowledge graph. Figure 10 This is a penetration testing technique based on knowledge graphs. Figure 11 This refers to the interaction between assets, vulnerabilities, and attacks. Figure 12 For LSTM neural network cells. Detailed Implementation

[0055] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0056] This invention provides an intelligent method for vulnerability scanning and verification in power information systems, specifically implemented as follows:

[0057] (1) Research on Web system vulnerability identification model based on machine learning

[0058] The machine learning-based web system vulnerability identification model has two phases: a learning phase and an identification phase. In the learning phase, a series of vulnerabilities are collected from the State Grid vulnerability database as input, and the output of this phase is the automated vulnerability identification model. In the identification phase, the target vulnerability is input, its features are extracted, and corresponding feature vectors are generated. The automated vulnerability identification model then classifies and identifies the type of the target vulnerability, finally outputting a report of the identified vulnerabilities. The model architecture is as follows: Figure 1 As shown.

[0059] Learning Phase: The goal of the learning phase is to build an automated vulnerability identification model. First, a series of vulnerabilities needs to be collected from a vulnerability database as a training set. Then, various features of the vulnerabilities in the training set are extracted, and corresponding feature vector spaces are generated. Based on the feature vector space, a machine learning model is trained to ultimately obtain an automated vulnerability identification model. The learning phase has three steps.

[0060] Step 1): Vulnerability feature extraction. Features are multiple quantifiable vulnerability characteristics that can be used to distinguish the types of vulnerabilities.

[0061] Step 2): Generation of vulnerability feature vectors to be trained. The multiple features extracted in Step 1) are used to generate the feature vector for each vulnerability. Each feature vector has a corresponding label indicating the type of vulnerability.

[0062] Step 3): Automated vulnerability identification model construction. An automated vulnerability identification model is constructed based on the labeled vulnerability feature vectors in the training set. The identification model is a machine learning model, and its training process is standard.

[0063] Identification Phase: Given one or more target vulnerabilities, the corresponding multi-class features are extracted by parsing the vulnerabilities. These multi-class features are converted into vector form and then input into a trained machine learning model (i.e., an automated vulnerability identification model). This model identifies which vectors are relevant ("1") or irrelevant ("0") to the corresponding labeled vulnerabilities and outputs a report of the identified vulnerabilities. Figure 1 As shown, this stage has three steps.

[0064] Step 4): Target vulnerability feature extraction. Three types of features are extracted from the target vulnerability: meta-features, text features, and code features (similar to Step 1).

[0065] Step 5): Target vulnerability feature vector generation. The features extracted in Step 4) are converted into vector representations (similar to Step 2).

[0066] Step 6): Automated vulnerability identification. This step uses the machine learning model trained during the learning phase to identify the feature vector type corresponding to the vulnerability. When a feature vector is identified as "1", it means that the corresponding vulnerability is an identified vulnerability, and a vulnerability report is output.

[0067] The techniques used in steps 1) and 2) and steps 4) and 5) are similar, only they are applied to different sets; the former is for the training set, and the latter is for the test set. Steps 3) and 6) are the standard machine learning model training and recognition process.

[0068] 1) Feature extraction

[0069] A vulnerability list contains a wealth of useful information, including field values, text content, and vulnerability patch files. To identify vulnerabilities, various useful features are extracted from the vulnerability report by parsing its format. These features can be categorized into three types: meta-features, text features, and code features. They are defined as follows:

[0070] Meta-feature definition: Meta-features refer to predefined non-text fields of a vulnerability, such as vulnerability submission time, priority, and severity. Many previous studies have used these fields to analyze vulnerabilities. As shown in Table 1, the following six fields are mainly focused on: reported time, severity, priority, last time, number of bug submissions (#bugs submitted), and number of patch submissions (#patches submitted). This is because these fields are usually found in most vulnerability listings. Furthermore, they can provide potential indicators for vulnerability identification.

[0071] Table 1. Meta-features related fields of vulnerability reports

[0072]

[0073] On one hand, the three fields of submission time, severity, and priority reflect the attributes of the vulnerability itself. On the other hand, since vulnerabilities are fixed by security personnel using patches, and the time and extent of their impact on the system vary, fields such as last active time, number of vulnerability submissions, and number of patch submissions are extracted from the vulnerability list.

[0074] Text Feature Definition: Text features refer to the textual content of a vulnerability, which has been used by many researchers for automated vulnerability identification. In this study, the text feature refers to the Summary field. It summarizes the submitter's description of the vulnerability and may contain potential semantic information that can be used for vulnerability identification.

[0075] Code Feature Definition: Code features refer to the code attributes of a vulnerability patch file, which can be used to detect vulnerabilities. In this study, code features are divided into four parts: i) whether dangerous functions or externally input functions exist, as shown in Table 2; ii) the number of lines of code added or deleted in the vulnerability patch; iii) the number of files involved in the vulnerability patch; and iv) the complexity of the vulnerability patch.

[0076] Dangerous functions refer to library functions or API (Application Programming Interface) functions that are prone to security vulnerabilities, such as `memcpy` and `strcpy`. For example, if there is no buffer validity check or length check before calling the `memcpy` function, it may lead to a buffer overflow. External input functions are library functions or API functions that directly receive one or more external inputs, such as command-line functions, socket functions, or file operations. For example, the `get` function is an external input function because it receives data directly from the command line. Improper use of these functions can lead to serious security problems; therefore, analyzing the presence of these functions in vulnerability patch files is considered one of the code characteristics.

[0077] Table 2. Hazard Functions and External Input Functions

[0078]

[0079] The first two types of features (i.e., meta-features and text features) can be easily extracted directly from the fields of the vulnerability list. For example, bug 1292443 is a security vulnerability (CVE-2016-5296) in Firefox version 52.0. The predefined non-text fields related to meta-features in its vulnerability list can be easily extracted. For text features, the summary field in the bug 1292443 report can be extracted, namely "Heap buffer overflowWRITE inrasterize_edges_l".

[0080] As for code features, the extraction process consists of the following four steps:

[0081] ① Download the patch file corresponding to the vulnerability by analyzing the attachment field of the vulnerability. For example... Figure 2As shown, a patch consists of a diff header and a diff section. The diff header provides a basic description of the patch information, while the diff section shows the code changes within the patch.

[0082] ② The number of lines of code added or removed in a vulnerability patch can be easily calculated using the prefix symbols "-" and "+". The number of files modified in a vulnerability patch can be calculated using the prefix symbol "++".

[0083] ③ Scan the code of these added or deleted lines to check for dangerous functions or externally inputted functions. In this study, a total of 140 library and API functions were selected as dangerous functions, of which 50 functions were related to external input (as shown in Table 2). These functions were selected based on Checkmarx, a commercial software. Checkmarx primarily detects vulnerabilities based on rules defined by security experts, involving multiple dangerous and externally inputted functions.

[0084] ④ Calculate the complexity of vulnerability remediation. For example... Figure 2 As shown, for bug 1292443, to fix the vulnerability, one file (i.e., "pixman-edge-imp.h") and 5 lines of code were modified. Therefore, the time complexity of fixing bug 1292443 is Hn(P) = 0.

[0085] 2) Feature vector generation

[0086] The goal of the feature vector generation module is to convert the extracted features into vector representations, which is essential for training a machine learning model. The training set consists of a set of input samples, each containing an input object (feature vector) and its corresponding label. As mentioned above, the feature vector describes the vulnerability report in three dimensions: meta-features, text features, and code features. For each dimension, a series of features are extracted. Therefore, the feature vector of a vulnerability can be represented as:

[0087] V report ={v meta ,v text ,v code} (1)

[0088] Among them, meta is transformed from a set of meta-features, tet is transformed from a set of text features, and code is transformed from a set of code features;

[0089] For the meta-features, after numerical mapping and normalization, they are finally converted into meta-feature vectors, represented as:

[0090] v meta ={V m1 V m2, ...,V m6} (2)

[0091] Among them, V m1 V corresponds to the time the vulnerability was submitted. m2 Indicates the severity of the vulnerability, with values ​​ranging from 0 to 6, corresponding to 6 different severity labels. "0" indicates that the corresponding severity field is empty. m3 This indicates the vulnerability priority, with values ​​ranging from 0 to 5, corresponding to 5 different priority tags. "0" indicates that the corresponding priority field is empty. mi (4≤i≤6) correspond to the other fields in the dangerous functions and external input functions in Table 2, respectively;

[0092] For text features, the focus is on the vulnerability summary field, which is a sentence summarizing the vulnerability. This sentence is analyzed using natural language processing techniques and ultimately transformed into sentence vector graphics.

[0093] The formula, as a text feature vector, includes the following three steps:

[0094] ① Tokenization. Tokenization is a process that uses lexical analysis to break a sentence down into a set of tokens based on delimiters such as spaces and punctuation marks. During tokenization, tokens should also be converted to lowercase letters, and special characters such as "<" and "@" should be removed.

[0095] ② Stop word removal. Many words are frequently used in various sentences, but may not contain much meaning or useful information. These words are called stop words, including but not limited to pronouns (such as "I", "he", "she"), articles (such as "a", "an", "the"), prepositions (such as "in", "to", "by"), and conjunctions (such as "and", "but", "then"). Due to their asymmetric distribution, these stop words must be removed from the token set generated in the previous step, as they may affect the performance of the recognition model.

[0096] ③ Vector Generation. After stop word removal, a large number of meaningful tokens are obtained. To map these tokens into vectors, the word2vec library is used. Widely used in natural language processing, it can convert a token into a fixed-dimensional vector, i.e., a word embedding. Finally, the word embeddings corresponding to all the tokens that make up the sentence are summed to obtain the sentence vector (i.e., the text shown in Equation 3). Since word embeddings can be trained to different fixed dimensions (e.g., 5, 10, 15, etc.), the corresponding sentence vectors also have different dimensions (n). The dimension of the sentence vector can be adjusted to improve recognition accuracy.

[0097]

[0098] For code features, the attachment fields of the vulnerability list are extracted. After parsing the patch files, the corresponding code feature vectors are calculated and generated, as follows:

[0099]

[0100] Among them, v c1 v c2 A value of "1" indicates that at least one dangerous function or externally input function exists in the vulnerability patch file; otherwise, a value of "0" is assigned. c3 The number of lines of code added or removed in the corresponding vulnerability patch, v c4 The number of files involved in the corresponding vulnerability patch, v c5 The complexity of the corresponding vulnerability patch.

[0101] 3) Recognition Model Construction

[0102] After generating feature vectors, a Support Vector Machine (SVM) is used to build an automated vulnerability identification model. SVM is a very popular supervised learning algorithm widely used in pattern recognition, classification, and regression analysis. The basic model of SVM is a margin-maximizing linear classifier. Although it is a linear model, it can effectively achieve non-linear classification by mapping the input to a higher-dimensional feature space through a kernel function.

[0103] For the design objectives, choosing the Radial Basis Function (RBF) as the kernel function is very reasonable, because it can map the original features from the low-dimensional space to the high-dimensional space, thus handling the nonlinear relationship between class labels and attributes very well. After selecting the RBF function as the kernel function, according to formulas (5)-(7), in order to solve the optimization problem of SVM, two very important parameters need to be determined, namely c and g, which correspond to the loss function and the gamma function, respectively.

[0104]

[0105] 0≤α i ≤c,i=1,2,…,N (7)

[0106] Formulas (5)-(7) above are the three basic formulas for the dual problem of convex quadratic programming. Assume that the two chosen variables are α1 and α2, and the other variables are α i (i = 3, 4, ..., N) is fixed;

[0107] Based on the training set (i.e., labeled feature vectors), 10-fold cross-validation and grid search are used to select the globally optimal combination of parameters c and g. 10-fold cross-validation involves randomly dividing the dataset into ten subsets. Nine subsets are used as the training set to train the model, and the remaining subset is used as the test set to evaluate the model's performance. This process is iterated ten times, and the average accuracy of the ten cross-validations is taken as the result. Grid search involves experimenting with a series of candidate values ​​(various parameter combinations) to find the set of parameters with the best cross-validation accuracy, which is the globally optimal set. Empirically, exponentially growing sequences (e.g., c=2) are quite practical when setting candidate values. -5 ,2 -3 , ..., 2 15 g=2 -15 ,2 -13 , ..., 2 3 ).

[0108] After a series of parameter tuning and training, a machine learning model with precisely tuned parameters was finally constructed, which can be used for automated vulnerability identification. According to formula (8), the target is traversed to obtain all test paths from the initial state to the target state.

[0109] P(S t+1 =x|S0,…S t )=P(S t+1 =x|S t (8)

[0110] Equation (8) is the basic definition formula for a Markov decision process. The Markov property states that the state at the next moment depends only on the state at the current moment, and other historical information can be discarded because the state is already a sufficient statistical representation of the future. Given the values ​​of the preceding states and actions, s t This represents the probability of these values ​​occurring at time t.

[0111] During model traversal (e.g.) Figure 3This process will extract all types of vulnerability threats, confirm the initial state and detection result state, create respective sub-state transition diagrams, and ultimately form a global state. Finally, it will perform a comprehensive judgment through automated vulnerability identification and output the model detection results. The model principle is as follows: Figure 4 .

[0112] Taking injection-type vulnerabilities as an example, firstly, we use the state of the Web system as the first label. The state of the Web system is used as the basis for judging the overall feasibility of exploiting the vulnerability when making model calls. We mark it as St.

[0113] Secondly, we use the current SQL user permissions as the second label of the model, such as IUSR, NORMAL, DB-OWNER, USER, WEBADMIN, etc. This label serves as the basis for judging the vulnerability design permissions and the permission support for the subsequent vulnerability impact scope.

[0114] Third, the injection vulnerability type is used as the third label for model building, such as injection vulnerability at user authentication site, link injection vulnerability, etc. This label will confirm the location of the vulnerability's effect when the model is called.

[0115] Fourth, the harm caused by the vulnerability is used as the fourth model label, which is marked by capabilities, including bypassing authentication to obtain authorization from ordinary users, client-side connection trojans, calling server components to upload script trojans, obtaining the current user's privileges in the system, etc.

[0116] Fifth, fingerprint feature research was conducted on various types of vulnerabilities, including traditional fingerprint features and behavioral features, from multiple dimensions such as threat functions, threat calls, threat parameters, corresponding features, and behavioral feedback.

[0117] And so on, the model content can be gradually improved and expanded based on subsequent research. An abstract table of the model content is shown in Table 3.

[0118] Table 3. Abstract Table of Model Content

[0119]

[0120] 4) Model accuracy evaluation

[0121] In this project, since a classification algorithm is used, the prediction results are not continuous. Here we use the following method to represent the prediction results as shown in Table 4.

[0122] Table 4 Prediction Classification Table

[0123]

[0124] Among them, TN indicates that the predicted negative result is also negative, FP indicates that the predicted positive result is also negative, FN indicates that the predicted negative result is also positive, and TP indicates that the predicted positive result is also positive.

[0125] ① Precision, Recall, Accuracy, and F-Score Evaluation. Precision refers to the percentage of truly positive samples that were actually positive, while recall refers to the percentage of truly positive samples that were correctly predicted as positive. That is, precision is (TP+TN) / (TP+FP+TN+FN), recall is TP / (TP+FN), and accuracy is TP / (TP+FP). The F-score is calculated as 2*precision*recall / (precision+recall). Higher precision, recall, and F-score indicate better prediction results. TP represents truly positive samples that were predicted as positive, TN represents truly negative samples that were predicted as negative, FP represents truly negative samples that were predicted as positive, and FN represents truly positive samples that were predicted as negative. Generally, precision and recall are contradictory; increasing precision decreases recall, and vice versa. Therefore, the F-score is often used to comprehensively evaluate model performance.

[0126] ② Root mean square error

[0127] The root mean square error, also known as the standard error, is the square root of the ratio of the square of the deviation between the observed value and the true value to the number of observations, n.

[0128]

[0129] RMSE (Root Mean Square Error), also known as standard error, where n is the number of measurements; RMSE represents the deviation between a set of measured values ​​and the true values; the smaller the RMSE, the lower the prediction error and the better the result.

[0130] ③ ROC curve

[0131] In logistic regression, a threshold is typically set to define positive and negative examples; those above the threshold are considered positive, and those below are considered negative. If we decrease this threshold, more samples will be identified as positive, improving the positive class recognition rate. However, this also leads to more negative samples being incorrectly identified as positive. To visually represent this phenomenon, we introduce ROC (Regression on the Curve). The ROC curve can be used to evaluate the performance of a classifier.

[0132] Here we define TPR = TP / (TP+FN), which is the probability of correctly predicting a positive outcome, and FPR = FP / (FP+TN), which is the probability of misclassifying a negative outcome as a positive outcome.

[0133] In the ROC space, the x-coordinate of each point is the FPR (Front-Place Response), and the y-coordinate is the TPR (Trust-Place Response), which depicts the difference between the classifier's TP (Trust-Place Response) and FP (Front-Place Response). The closer the ROC curve is to the top left corner, the better the classifier's performance (e.g., ...). Figure 5 ).

[0134] ④AUC

[0135] AUC (Area Under Curve) is defined as the area under the ROC curve, and obviously, this area will not be greater than 1. Given a randomly selected positive sample and a negative sample, the probability that the classifier classifies the positive sample as having a higher value than the negative sample is the AUC value. A classifier with a higher AUC value has a higher accuracy (e.g., ...). Figure 6 ).

[0136] Compared to traditional root mean square error (RMSE), precision, recall, accuracy, and F-score, ROC curves and AOC have a significant advantage: in real-world datasets, class imbalance often occurs, meaning there are far more negative samples than positive samples (or vice versa). When the distribution of positive and negative samples in the test set changes, the curve remains constant. This is why ROC and AOC are used.

[0137] (2) New Model of Intelligent Vulnerability Verification

[0138] To achieve intelligent development of power system vulnerability exploitation verification, this project plans to adopt two intelligent technology modes: one is a target machine-based intelligent vulnerability exploitation verification mode, and the other is a human experience tree-based intelligent vulnerability exploitation verification mode. These two methods will be combined to achieve intelligent, accurate, and non-destructive vulnerability verification. The specific modes are as follows: Figure 7 .

[0139] ① Input the penetration test target;

[0140] ② Begin host port scanning, port service scanning, web system fingerprint scanning, etc., to collect information and generate fingerprint data of the target object.

[0141] ③ By matching and comparing the fingerprint information with the vulnerability fingerprint database, the vulnerability information of the target system is initially identified;

[0142] ④ Analyze and organize exploit scripts such as EXPs and payloads based on vulnerability information;

[0143] ⑤ Submit the generated vulnerability exploit script to the target machine platform;

[0144] ⑥ Initiate intelligent exploitation verification based on the target machine;

[0145] ⑦ Decision-making generates target machine environment, generates EXP, Payload combination and exploit sequence;

[0146] ⑧ Conduct target training

[0147] ⑨ Store the successfully trained EXPs and Payloads to generate accurate and usable EXP trees and Payload trees;

[0148] 10. Record the unsuccessful exploits and payloads, enable intelligent exploit verification based on human experience trees, and recombine the unsuccessful exploits and payloads using human experience trees. Red team members can also intervene and redesign the relevant experience trees.

[0149] Generate a complete, accurate, and usable EXP tree and Payload tree;

[0150] Submit and implement penetration testing.

[0151] (3) Automatic extraction of Web penetration testing payload

[0152] In recent years, machine learning (including deep learning) has made a high-profile entry into the public eye and has been gradually applied to the field of information security. Applying machine learning to web penetration testing to improve its efficiency and accuracy has always been a goal pursued by security researchers. To ensure the accuracy and reliability of penetration testing after applying machine learning, researchers tend to use supervised learning algorithms, training models using pre-labeled sample data (payloads). However, the reality is that both industry and academia lack publicly available attack sample datasets, meaning that web penetration testing systems based on supervised learning algorithms often remain in the theoretical discussion stage or are trained with limited data, making it difficult to fully verify the effectiveness of the methods and provide practically valuable penetration testing models. Based on these issues, this project will analyze attack-containing traffic logs and, considering the differences in parameters and content of attack traffic, automate the extraction of attack content (payloads), laying the foundation for further training of automated penetration testing models.

[0153] 1) Overall Approach

[0154] The principle behind automated payload extraction is based on parameter anomalies. Quantifying the degree of anomaly among each parameter in a request is key to successful payload extraction. To maximize the utilization of the web system's structural information contained in logs, the request is first broken down by access path, that is, the degree of anomaly of the parameter value compared to other parameters with the same path and parameter key.

[0155] It can be roughly divided into 3 steps:

[0156] ① Based on TF-IDF, the samples under different paths are vectorized into feature vectors, and the feature vectors are aggregated according to the parameter dimension.

[0157] ② Based on the feature vector, extract the anomaly score AS among other parameter values ​​of the same parameter Key along the same path.

[0158] ③ Set a threshold T, and take out the abnormal parameter values ​​that AS is greater than T as the output.

[0159] To fully leverage existing model algorithms and training experience, we treat access log information as text and select the TF-IDF model (term frequency–inverse document frequency) to vectorize the access log features. TF-IDF is a statistical method used to evaluate the importance of a word to a set of documents or a corpus. The importance of a word increases proportionally to the number of times it appears in a document, but decreases inversely proportionally to its frequency in the corpus. Various weighted forms of TF-IDF are commonly used by search engines as a measure or ranking of the relevance between documents and user queries.

[0160] The main idea of ​​TF-IDF is that if a word or phrase has a high TF (Term Frequency) in one document and rarely appears in other documents, then this word or phrase is considered to have good class distinguishing ability and is suitable for classification. TF-IDF is actually TF*IDF. TF represents the frequency of a term in document d. The main idea of ​​IDF (Inverse Document Frequency) is that the fewer documents containing term t, that is, the smaller n is, the larger the IDF is, indicating that term t has good class distinguishing ability. If the number of documents containing term t in a certain class C is m, and the total number of documents containing t in other classes is k, then obviously the total number of documents containing t is n = m + k. When m is large, n is also large, and the IDF value obtained according to the IDF formula will be small, indicating that the class distinguishing ability of term t is not strong. However, in reality, if a term appears frequently in documents of a certain category, it means that the term can well represent the characteristics of the text of that category. Such terms should be given higher weights and selected as feature words of that category of text to distinguish them from documents of other categories.

[0161] 2) Data set and preprocessing process

[0162] Several publicly available access log datasets exist. In this project, we selected the HTTP CSIC 2010 dataset, which contains 36,000 labeled normal requests and 25,000 attack requests. The attack requests cover various attack types, including SQL injection, file traversal, CRLF injection, XSS, and SSL, allowing for a relatively comprehensive extraction of common payload types.

[0163] Based on observation, the HTTP CSIC 2010 dataset, apart from the path (URI) and parameters, contained no attack payloads in its headers and contained a lot of redundant information. Therefore, the dataset was formatted to retain only the HTTP method, path, and parameters, and converted to JSON format for later use. The following preprocessing was performed:

[0164] ① Remove redundant information.

[0165] ② Perform iterative urldecode (see code implementation below for details).

[0166] ③ Generate standardized parameters, converting uppercase and lowercase letters and numbers to 'a' and 'n' respectively. Both the original and standardized parameters are retained for final payload extraction.

[0167]

[0168]

[0169] 3) Implementation method

[0170] ① Vectorization and parameter anomaly scores

[0171] The components of a web access record are relatively fixed, with each part (method, path, parameters, HTTP headers, cookies, etc.) exhibiting well-structured characteristics. Therefore, web attack identification tasks can be abstracted into text classification tasks, and this approach has been applied in the security field, such as supervised attack identification and XSS detection. Commonly used vectorization techniques in text classification tasks include the Bag of Word (BOW) model, the TF-IDF model, and word vectorization (word2vec).

[0172] Based on our analysis of the characteristics of web logs, we believe that using TF-IDF to vectorize samples is more effective. First, even after standardization, request parameter values ​​still have a wide range of possibilities. In such cases, the feature vectors generated by the bag-of-words model would be extremely long and unscalable. Second, the number of parameters in each request varies greatly, with most requests containing no more than 10. In this case, word vectors can only express a very limited amount of information and cannot reflect the anomalies of parameter values. Third, TF-IDF can express whether the values ​​of the same parameter across different requests are more specific, especially the IDF term.

[0173] For example, http: / / ip.taobao.com / ipSearch.html?ipAddr=8.8.8.8 is a page that queries detailed IP information (it actually exists). Within a certain period, it received 10,000 requests. In 9,990 of these requests, the ipAddr parameter value conformed to the format xx.xx.xx.xx. After standardization as mentioned in point 2, the ipAddr parameter for these 9,990 requests would be n+.n+.n+.n+ (this is a simplification, and the number may not be multi-digit). Additionally, 10 requests had ipAddr values ​​in the form of different attack payloads such as alert('XSS') or 'or'1'='1'.

[0174] After TF-IDF vectorization, the TF-IDF value of the term ipAddr = n+.n+.n+.n+ for the 9900 requests is as follows:

[0175] TF-IDF normal=TF*IDF=1*log(10000 / (9990+1))=0.001

[0176] The TF-IDF value of a request containing ipAddr=alert('XSS') is:

[0177] TF-IDF abnormal=TF*IDF=1*log(10000 / (1+1))=8.517

[0178] It can be seen that the TF-IDF of the abnormal request parameter value is much larger than that of the normal request. Therefore, TF-IDF can reflect the degree of abnormality of the parameter value very well.

[0179] TF-IDF (term frequency-inverse document frequency) is a commonly used weighting technique in information retrieval (Q) and test mining. TF-IDF is a statistical method used to evaluate the importance of a word to a document within a document set or corpus. A word's importance increases proportionally to its frequency in the document, but decreases inversely proportionally to its frequency in the corpus. To address the issue of sparse feature vectors in TF-IDF, we further process all TF-IDF values ​​by summing TF-IDF terms with the same parameter key. Let the set of parameter keys be K = {k1, k2, ..., kn}, and the TF-IDF dictionary be x = {x1, x2, ..., xn}. Then the feature values ​​for each parameter key are:

[0180] Vn=∑TF-IDFxn where xn∈{x|x startswith kn}

[0181] To verify whether the aforementioned feature vectors can adequately reflect the anomalies of the samples, an untuned random forest model was used for validation, achieving an accuracy greater than 95%. The following figure shows the model's learning curve, indicating that it is still in an undertrained state (e.g., ...). Figure 8 If the sample size is larger, better results will be obtained.

[0182] ② Extraction of abnormal parameter values

[0183] Obtaining the parameter anomaly score mainly involves the following three steps:

[0184] 1) Data standardization;

[0185] 2) Determine abnormal parameters based on threshold values;

[0186] 3) Extract the corresponding parameter values ​​based on the position of the abnormal scores in the training set matrix.

[0187] The specific data standardization and outlier value extraction process is as follows:

[0188]

[0189]

[0190] As you can see, the abnormal parameter values ​​have now been extracted, including typical attack fields such as SQL injection, XSS, command injection, CRLF injection, and file inclusion.

[0191] (4) Knowledge graph-based penetration testing methods

[0192] Knowledge graphs incorporate various technologies such as artificial intelligence, semantic parsing, and data fusion. Leveraging big data, they can intuitively display relationships between elements, clarify connections, and predict future trends, gradually becoming a powerful tool for researchers to solve threat intelligence problems. Essentially, a knowledge graph is a semantic network. In the big data environment, the expansion of Web resources and the surge in information volume bring new challenges and opportunities to knowledge graphs. Integrating and processing useful resources in a complex data environment, and clarifying resource relationships, forms a semantic knowledge network. Based on this, further research into penetration testing methods based on knowledge graphs can improve the efficiency of penetration testing.

[0193] 1) Knowledge Graph Framework Design

[0194] Figure 9 This paper describes a method for constructing a cybersecurity knowledge base. The framework mainly involves three parts: data source, information extraction and ontology construction, and generation of a cybersecurity knowledge graph.

[0195] Data sources can be categorized into structured and unstructured data. This paper proposes an information extraction method based on rule-based and machine learning approaches. The ontology shown at the bottom of the framework lays the foundation for information extraction.

[0196] Knowledge graphs are a concept first proposed by Google in 2012. They are semantic networks that store entities and relationships between them in graph form. The advantages of knowledge graphs are obvious: their relevance query efficiency is higher than traditional storage methods, and they are easy to update due to their flexible storage structure. Since the construction of vertical knowledge in cybersecurity must consider the depth and overall hierarchical structure of knowledge, a top-down approach was adopted: first, a cybersecurity ontology was constructed; based on this ontology, cybersecurity information was extracted from structured and unstructured data. The following discussion focuses on ontology construction and knowledge extraction.

[0197] 2) Network security ontology construction

[0198] Researching knowledge graph-based penetration testing methods first requires constructing a cybersecurity knowledge graph comprising five dimensions: basic, vulnerability, threat, alert events, and attack rules. Specifically, this involves: collecting knowledge information from these five dimensions, including CVE vulnerability knowledge, CAPEC attack classification, CWE host software knowledge, Snort alert event knowledge, and attack rule expert knowledge; extracting entity attribute information using XML processing programs and regular expressions; and using the graph database Neo4j as the knowledge graph construction tool, inserting the aforementioned knowledge information into the knowledge graph using Cypher statements.

[0199] After constructing the cybersecurity knowledge graph, further research is needed on penetration testing methods based on the knowledge graph. A specific framework would be as follows: Figure 10 As shown, it comprises three entities: assets, vulnerabilities, and attacks. The interactions between the three are as follows: Figure 11 As shown.

[0200] ① Vulnerability: Each record in the vulnerability database corresponds to an instance of a vulnerability type. Each vulnerability has its unique CVE ID.

[0201] ② Assets: In this paper, assets include software and operating systems (OS).

[0202] ③ Software: This is a subclass of assets (such as Adobe Reader).

[0203] ④ Operating System: This is a subclass of assets (e.g., Ubuntu 14.04).

[0204] ⑤ Attack: Most attacks can be considered as intrusions targeting a vulnerability, such as an attack process that may be a vulnerability exploitation process.

[0205] 3) Extraction of cybersecurity-related entities: Machine learning-based methods

[0206] Conditional Random Fields (CRFs) are undirected graphical models based on statistical sequence identification and segmentation. The main idea of ​​this model comes from the maximum entropy model, and its simplest form is the linear CRF, in which the nodes in the model form a linear structure. The linear CRF corresponds to a finite state machine, which is very suitable for labeling linear data sequences.

[0207] Named entity recognition (NER) can be defined as a sequence labeling problem, i.e., whether observed words belong to a predefined set of features. Conditional Random Fields (CRFs) are probabilistic models for sequence labeling. They have no independent assumptions, allow arbitrary feature selection, globally normalize all features, and obtain a globally optimal solution. They retain the advantages of conditional probabilistic frameworks, such as the maximum entropy Markov model. They also address the labeling bias problem. Therefore, CRF models are suitable for named entity recognition. Linear CRFs are currently the best method for named entity recognition. It is a probability distribution model P(y|x), where x is the observed sequence and y is the labeled sequence. P(y|x) is calculated using the following formula:

[0208]

[0209] In the formula, N is the number of words; M is the number of features. fi is a binary function, and its specific values ​​are shown in the following formula:

[0210]

[0211] Operating system (OS), XP refers to Windows XP system, which meets the requirements of ify j-1 is OS,y j is OS and x j When is XP, f i The value is 1 if it is 1, otherwise it is 0.

[0212] StanfordNER provides a general implementation of linear chain conditional random field (CRF) sequence models, and is therefore also known as a CRF classifier. In this paper, StanfordNER is used to extract entities relevant to cybersecurity. StanfordNER offers a wide range of feature options. This paper uses StanfordNERbase to train the extraction model because our goal is also to train an NER in the cybersecurity domain.

[0213] Feature selection is crucial when building a model. Here, a feature that better identifies cybersecurity-related entities should be chosen. A good combination of features is key to training a well-developed extraction model.

[0214] Stanford NER provides over 70 features that can be used to train the model. Determining suitable features is not an easy task, as Stanford doesn't provide much documentation explaining these features. Existing feature selection algorithms are not very helpful for our work. We had to analyze the existing features ourselves and select those we believed were useful for training the model. Then, we validated our ideas through experiments. After numerous experiments, we determined a feature set for training the named recognition engine. Training the NER based on this feature set achieved good recognition results. We decided to use the following feature set to train the named recognition engine.

[0215] ①UseNGrams: Use n-grams to extract features, i.e., substrings of words.

[0216] ②MaxNGramLeng: This feature has an integer value. If the value of this feature is positive, n-grams with values ​​greater than this will not be used in the model. In this paper, we set the value of maxNGramLeng to 6.

[0217] ③UsePrev: This provides us with the feature <previous word, class of previous word>, and can be enabled in conjunction with other options such as <previous tag, class>. This results in features based on the relationship between the current word and a pair of <previous word, class of previous word>. This feature is very useful when consecutive words belong to the same class.

[0218] ④UseNext: Very similar to UsePrev.

[0219] ⑤UseWordPairs: This feature is based on two word pairs—<Previous word, current word, class> and <current word, next word, class>.

[0220] ⑥UseTaggySequences: This is an important feature. It uses sequences of classes instead of sets of words, and uses first, second, and third order classes and tag sequences as interaction features.

[0221] ⑦UseGazettes: If true, the next feature named "gazette" will point the document to an entity dictionary.

[0222] ⑧Gazette: This value can be one or more filenames (names separated by commas, semicolons, or spaces). If loading a public entity dictionary from these files, each line should contain an entity class name, followed by a space, and then an entity.

[0223] ⑨CleanGazette: If this value is true, this feature will only be triggered if the entire word is matched in the dictionary. If there is a word "Windows 7" in the dictionary, then the entire word should be matched in the dictionary.

[0224] ⑩SloppyGazette: If this value is true, this feature can also be triggered by partial matching of words with words in the dictionary, such as matching "Windows" with "windows 7".

[0225] To utilize this feature, we aggregated relevant information from the influence platform field in the vulnerability database and constructed an entity dictionary. The first column of the dictionary is the entity type, and the second column corresponds to a specific entity.

[0226] (5) Using recurrent neural networks to guide web vulnerability penetration testing

[0227] First, based on the vulnerability discovery experience of the company's outstanding red team members, textual features are extracted from the vulnerability discovery experience, and one-hot encoding is used to represent the target environment information and the manual penetration methods contained in the experience. Second, the target environment information represented by the one-hot encoding is used as input and passed to the input layer of a recurrent neural network. This application uses LSTM (Long Short-Term Memory), which is essentially a complex recurrent neural network. LSTM is used to learn the potential correlation between target environment information and the corresponding penetration methods. Finally, the trained LSTM neural network model is recorded, and the environment information of the unknown vulnerable system is input into the model. Based on the penetration methods output by the model, the target system is used for vulnerability penetration verification. The specific method steps are as follows:

[0228] Step 1): Divide the manual vulnerability penetration testing experience into reasonable segments. The above experience describes a complete vulnerability penetration testing process. Based on the different testing methods used, divide the experience into multiple segments. For example:

[0229] Segment 1: Obtain target environment information and locate the user login window;

[0230] Segment 2: Login window + further information on the target environment and obtaining the login password

[0231] Segment 3: Login password + further acquisition of target environment information and reading of sensitive data

[0232] The target environment information includes: system type, system version, service type, service version, middleware type, middleware version, development language, and data response package content. The vulnerability exploitation methods are summarized as follows: information disclosure vulnerabilities, command execution vulnerabilities, arbitrary file read vulnerabilities, IIS middleware vulnerabilities, Weblogic middleware vulnerabilities, NGINX middleware vulnerability exploitation modules, PHP vulnerability exploitation modules, Tomcat middleware vulnerability exploitation modules, JBOSS middleware vulnerability exploitation modules, SQL injection vulnerabilities, management entry point vulnerabilities, Form framework vulnerability exploitation modules, editor vulnerabilities, XSS vulnerabilities, file upload vulnerabilities, command injection vulnerabilities, XML external entity vulnerabilities, arbitrary file download vulnerabilities, directory traversal vulnerabilities, file inclusion vulnerabilities, CMS vulnerabilities, common service vulnerabilities, hardware and system vulnerabilities, etc. The descriptions in the fragment are categorized according to the above classifications to establish a data sample linking target environment information and vulnerability exploitation methods. For example: [XX system, XX system version, XX service type, XX service version, XX interface development language…][Management entry point vulnerability].

[0233] Step 2): The associated data samples established in step (1) are converted into a data format that can be input into the LSTM neural network through one-hot encoding. One-hot encoding uses an N-bit state register to encode N states, each state has an independent register bit, and only one of these register bits is valid. For example, system types are divided into Windows, Linux, MacOS, NingSi, Kylin, etc., and the corresponding one-hot encodings are (0,0,0)(0,0,1)(0,1,0)(0,1,1)(1,0,0). The features in all target environment information are generated into input data through one-hot encoding. For vulnerability penetration methods, 23 bits of 0 and 1 are used to represent them. For example, information leakage vulnerability is represented as: [1,0 ...

[0234] Step 3): Preprocess the input data. After one-hot encoding of the target environment information, the length of the converted data may vary due to differences in the target environment information recorded in different experiences. For the convenience of subsequent input into the LSTM neural network, the data dimension is uniformly defined as 128 bits. For data with insufficient length, 0 bits are used; for data with excessive length, a hash function is used for dimensionality reduction.

[0235] Step 4): Construct the LSTM neural network. A standard LSTM neural network cell is as follows: Figure 12 As shown.

[0236] A standard LSTM neural network includes an input gate, a forget gate, and an output gate. We use LSTM here because simple RNNs (Recurrent Neural Networks) are prone to gradient vanishing and gradient exploding, while LSTM can effectively prevent the gradient vanishing problem through gate control.

[0237] As can be seen from the segments obtained in step 1), there is a correlation between the segments. The output of the previous segment (i.e., the vulnerability penetration verification method used) can be used as part of the input of the next segment. Therefore, the time step in the input of the LSTM neural network is set to 2 to consider the impact of the previous penetration verification method on the current one. The input data of a segment has 128 dimensions, so the input layer of the LSTM is designed with 128 input parameters, including 2 hidden layers, each with 2 cells, and the output layer also has 128 parameters. In order to enable the output layer to map to the penetration method in step 1) (a one-hot representation of length 24, where 23 bits represent 23 vulnerability penetration methods and 1 bit represents no penetration method), a linear fully connected layer needs to be added after the output layer, taking the 128 parameters as input and setting the output parameters to 24.

[0238] Step 5): Train the parameters of the LSTM neural network. Calculate the parameters of the LSTM neural network built in Step 4) using the cross-entropy loss function in Tensorflow. Input the LSTM output value and the corresponding true value (i.e., the corresponding one-hot representation of the percolation method) into the cross-entropy loss function. This function will perform internal calculations to obtain the current loss value. The smaller the loss value, the closer the output is to the true value, and the closer the LSTM parameters are to the desired values. Then, use the RMSProp (Root Mean Square Prop) optimizer in Tensorflow to update the LSTM parameters based on the loss value until the loss value is below a set threshold. Save the current LSTM parameters and end the training process.

[0239] Step 6): Use the trained LSTM neural network to guide vulnerability penetration testing. Obtain information about the target system through asset scanning and identification. Preprocess the obtained target information using steps 1)-3). Input the processed 128-bit data into the LSTM neural network. Based on the 24-bit data output by the LSTM, select the corresponding penetration testing method to verify the vulnerability.

[0240] The above are preferred embodiments of the present invention. Any changes made to the technical solution of the present invention that do not exceed the scope of the technical solution of the present invention shall fall within the protection scope of the present invention.

Claims

1. An intelligent method for vulnerability scanning and verification in a power information system, characterized in that, include: S1. Construct a machine learning-based web system vulnerability identification model; S2, Intelligent Vulnerability Verification; S3, automatic extraction of Web vulnerability penetration test payloads; S4. Knowledge graph-based web vulnerability penetration testing; S5. Utilize recurrent neural networks to guide web vulnerability penetration testing; The specific implementation method of step S3 is as follows: S31. Based on TF-IDF, feature vectors are generated for Web log data samples from different paths, and the feature vectors are aggregated according to the parameter dimension. S32. Extract the anomaly score AS of the sample parameter among other parameter values ​​of the same parameter Key in the same path based on the feature vector; S33. Set a threshold T, and take out the abnormal parameter values ​​where AS is greater than T as the output; S34. Automatic extraction of payload for Web vulnerability penetration testing based on abnormal parameter values; Step S5 is implemented as follows: Step S51: Divide the manual vulnerability penetration testing experience. The manual vulnerability penetration testing experience describes a complete vulnerability penetration testing process. Based on the use of different vulnerability penetration testing methods, the manual vulnerability penetration testing experience is divided into multiple segments, including: Segment 1: Obtain target environment information and locate the user login window; Segment 2: Login window + Obtain target environment information and login password; Segment 3: Login password + obtaining target environment information and reading sensitive data; Step S52: Convert the associated data samples established in step (1) into a data format that can be input into the LSTM neural network through one-hot encoding; Step S53: Preprocess the input data: After converting the target environment information into one-hot encoding, since there are differences in the target environment information recorded in different experiences, for the convenience of subsequent input into the LSTM neural network, the data dimension is uniformly specified to be 128 bits. For data with insufficient length, 0 bits are used, and for data with excessive length, a hash function is used to reduce the dimension. Step S54: Constructing an LSTM neural network: Based on the segments obtained in step S51, it can be seen that there is a correlation between the segments. The output of the previous segment can be used as part of the input of the next segment. Therefore, in the input of the LSTM neural network, the time step is set to 2. The input data of a segment has 128 dimensions. Therefore, the input layer of the LSTM is designed with 128 input parameters, including 2 hidden layers, each with 2 cells. The output layer also has 128 parameters. A linear fully connected layer is added after the output layer, taking the 128 parameters as input and setting the output parameters to 24. Step S55: Train the parameters in the LSTM neural network; Step S56: Use the trained LSTM neural network to guide vulnerability penetration verification. Obtain information about the target system through asset scanning and identification. Use steps S51-S53 to preprocess the obtained target environment information. Input the processed 128-bit data into the trained LSTM neural network. Based on the output 24-bit data, select the corresponding penetration verification method to verify the vulnerability.

2. The intelligent method for vulnerability scanning and verification in a power information system according to claim 1, characterized in that, In step S1, the machine learning-based Web system vulnerability identification model has two stages: a learning stage and an identification stage. In the learning stage, a series of vulnerabilities are collected from the vulnerability database as input, and the output of the learning stage is the automated vulnerability identification model. In the identification stage, the target vulnerability is input, and then the features of the target vulnerability are extracted and the corresponding feature vector is generated. The automated vulnerability identification model classifies and identifies the type of the target vulnerability, and finally outputs a report of the identified vulnerabilities. Specifically, The learning phase includes: Step 1) Extract the vulnerability features to be trained. Vulnerability features are multiple quantifiable vulnerability characteristics that can be used to distinguish the types of vulnerabilities, including meta-features, text features, and code features. Step 2) Generation of vulnerability feature vectors to be trained: The multiple vulnerability features extracted in Step 1) are used to generate the feature vector of each vulnerability. Each feature vector has a corresponding label indicating the type of vulnerability. Step 3) Automated identification model construction: Based on the labeled vulnerability feature vectors in the training set, construct and train an automated vulnerability identification model; The identification phase includes: Step 4) Target vulnerability feature extraction: Extract three types of features from the target vulnerability, namely meta-features, text features, and code features; Step 5) Target vulnerability feature vector generation: Convert the target vulnerability features extracted in step 4) into vector representations. Step 6) Automated vulnerability identification: Based on the test set, the automated vulnerability identification model trained during the learning phase identifies the feature vector type corresponding to the vulnerability. When the feature vector is identified as "1", it means that the corresponding vulnerability is an identified vulnerability, and a vulnerability report is output.

3. The intelligent method for vulnerability scanning and verification in a power information system according to claim 2, characterized in that, The specific method for code feature extraction in step 1) or step 4) is as follows: ① Download the corresponding patch file for the vulnerability by analyzing the Attachment field of the vulnerability. A patch consists of a diff header and a diff segment. The diff header gives a basic description of the patch information, while the diff segment shows the changes in the code in the patch. ② Calculate the number of lines of code added or deleted in a vulnerability patch based on the prefix symbols "-" and "+", and calculate the number of files modified in the vulnerability patch based on the prefix symbol "+++". ③ Scan the code of the added or deleted lines to check for dangerous functions or externally inputted functions; dangerous functions are library functions or API functions that are prone to security issues, and externally inputted functions are library functions or API functions that directly receive one or more external inputs; ④ Calculate the complexity of vulnerability remediation.

4. The intelligent method for vulnerability scanning and verification in a power information system according to claim 2, characterized in that, The specific method for generating feature vectors in step 1) or step 4) is as follows: Feature vectors describe vulnerability reports in three dimensions: meta-features, text features, and code features; for each dimension, a series of characteristics are extracted. Therefore, the feature vector of a vulnerability is represented as: Vre po rt ={vmeta,vtext,vcode} (1) Among them, meta is transformed from a set of meta-features, text is transformed from a set of text features, and code is transformed from a set of code features; For the meta-features, after numerical mapping and normalization, they are finally converted into meta-feature vectors, represented as: vmeta={V m1 ,V m2，…… ,V m6 } (2) Among them, V m1 V corresponds to the time the vulnerability was submitted. m2 Indicates the severity of the vulnerability, with values ​​ranging from 0 to 6, corresponding to 6 different severity labels. "0" indicates that the corresponding severity field is empty. m3 This indicates the vulnerability priority, with values ​​ranging from 0 to 5, corresponding to 5 different priority tags. "0" indicates that the corresponding priority field is empty. mi (4≤i≤6) correspond to the other fields in the dangerous function and the external input function, respectively; For text features, the focus is on the Summary field, which is a sentence summarizing the vulnerability. This sentence is analyzed using natural language processing techniques and ultimately converted into sentence vectors, which serve as text feature vectors. This process involves the following three steps: ① Tokenization is a process that uses lexical analysis to split a sentence into a set of tokens based on delimiters. During the segmentation process, the tokens should also be converted to lowercase letters and special characters should be removed. ② Stop words removal: Remove stop words from the tokens set generated in the previous step; ③ Vector generation: After stopping word deletion, a large number of meaningful tokens are obtained. In order to map these tokens into vectors, the word2vec tool library is used to convert a token into a fixed-dimensional vector, i.e., word embedding. Finally, the word vectors corresponding to all the tokens that make up the sentence are accumulated to obtain the sentence vector, i.e., as shown in formula (3). Since word vectors can be trained to different fixed dimensions, the corresponding sentence vectors also have different dimensions n. For code features, the attachment fields of the vulnerability list are extracted. After parsing the patch files, the corresponding code feature vectors are calculated and generated, as follows: Among them, v c1 v c2 A value of "1" indicates that at least one dangerous function or externally input function exists in the vulnerability patch file; otherwise, a value of "0" is assigned. c3 The number of lines of code added or removed in the corresponding vulnerability patch, v c4 The number of files involved in the corresponding vulnerability patch, v c5 The complexity of the corresponding vulnerability patch.

5. The intelligent method for vulnerability scanning and verification in a power information system according to claim 2, characterized in that, The method for constructing the automated vulnerability identification model in step 1) is as follows: After generating feature vectors, a support vector machine (SVM) is used to build an automated vulnerability identification model. The radial basis function (RBF) is selected as the kernel function. To solve the optimization problem of SVM, the parameters c and g are determined, corresponding to the loss function and gamma function, respectively. Based on the training set, i.e. the labeled feature vectors, 10-fold cross-validation and grid search are used to select the globally optimal combination of parameters c and g. Finally, an automated vulnerability identification model with precisely adjusted model parameters is constructed. The target is traversed to obtain all test paths from the initial state to the target state. During the traversal of the automated vulnerability identification model, all types of vulnerability threats will be extracted, the initial state and detection result state will be confirmed respectively, and their respective sub-state transition graphs will be created to form the global state. Finally, a comprehensive judgment will be made through automated vulnerability identification, and the detection results of the automated vulnerability identification model will be output.

6. The intelligent method for vulnerability scanning and verification in a power information system according to claim 1, characterized in that, In step S2, a combination of a target machine-based intelligent vulnerability exploitation verification mode and a human experience tree-based intelligent vulnerability exploitation verification mode is used to achieve intelligent vulnerability verification.

7. The intelligent method for vulnerability scanning and verification of a power information system according to claim 1, characterized in that, In step S4, the knowledge graph is a cybersecurity knowledge graph comprising five dimensions: basic dimension, vulnerability dimension, threat dimension, alarm event dimension, and attack rule dimension. Its construction method is as follows: Collect knowledge information from the five dimensions, including CVE vulnerability knowledge, CAPEC attack classification identification, CWE host software knowledge, Snort alarm event knowledge, and attack rule expert knowledge; extract entity attribute information by writing an XML processing program and regular expressions; use the graph database Neo4j as the knowledge graph construction tool, and insert the corresponding knowledge information into the knowledge graph by writing Cypher statements.

8. The intelligent method for vulnerability scanning and verification in a power information system according to claim 1, characterized in that, The target environment information includes: system type, system version, service type, service version, middleware type, middleware version, development language, and data response package content; the vulnerability exploitation methods include: information disclosure vulnerabilities, command execution vulnerabilities, arbitrary file read vulnerabilities, IIS middleware vulnerabilities, Weblogic middleware vulnerabilities, NGINX middleware vulnerability intelligent exploitation modules, PHP vulnerability intelligent exploitation modules, Tomcat middleware vulnerability intelligent exploitation modules, JBOSS middleware vulnerability intelligent exploitation modules, SQL injection vulnerabilities, management entry vulnerabilities, Form framework vulnerability intelligent exploitation modules, editor vulnerabilities, XSS vulnerabilities, file upload vulnerabilities, command injection vulnerabilities, XML external entity vulnerabilities, arbitrary file download vulnerabilities, directory traversal vulnerabilities, file inclusion vulnerabilities, CMS vulnerabilities, common service vulnerabilities, and hardware and system vulnerabilities; the descriptions in fragments 1, 2, and 3 are categorized to establish a data sample linking target environment information and vulnerability exploitation methods.

Images